Post #1139744
2026-04-14 01:41 UTC
@djb@mastodon.cr.yp.to @paulehoffman@infosec.exchange @rsalz@ioc.exchange I don't understand what you mean by "removing". The hybrid key exchanges are defined in https://datatracker.ietf.org/doc/draft-ietf-tls-ecdhe-mlkem/, which went through IETF last call and is in the final stage of approval by the IESG. I don't know that anybody is proposing to remove that.
Replies (1)
-
@djb@mastodon.cr.yp.to 2026-04-15 03:46
@huitema @paulehoffman @rsalz Let's try an example. Google and Cloudflare used CECPQ2b = ECC+SIKE for tens of millions of user connections, instead of the usual ECC. That wasn't _removing_ ECC in favor of SIKE; it was _supplementing_ ECC with SIKE. This is why the break of SIKE still left those connections with the usual security of ECC. If they had instead incompetently _removed_ ECC and replaced that with SIKE, the SIKE attack would have immediately broken all of those connections.